By Gerard M. Stegmaier, a partner, and Lawrence Burns, an associate, in Reed Smith LLP’s Emerging Technologies Group.

The Ninth Circuit’s decision in Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025), represents a significant victory for enterprises and website operators facing a flood of consumer class action litigation over the use of website analytics.  The panel’s ruling evidences a growing federal trend: plaintiffs alleging statutory privacy violations—without a close historic analogue of real-world harm long-recognized by American courts—may knock on the federal courthouse doors, but the doors are increasingly closed where no concrete injury is alleged.

Case Overview

Ashley Popa’s complaint against Pet Supplies Plus and Microsoft alleged that routine use of Microsoft’s analytics software violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA) and the common law tort of intrusion upon seclusion. The suit claimed that tracking user clicks, scrolls, and navigation—ubiquitous features on most modern commerce websites—constituted wiretapping, with each “interception” supporting statutory damages, theoretically amounting to millions and even tens of millions in exposure for many such sites. The court evaluated whether a plaintiff could establish Article III standing in federal court by merely the existence of statutory privacy violations and held it could not.

The Ninth Circuit’s Reasoning: Concrete Harm Demanded

Affirming the district court’s dismissal, the panel rooted its analysis in recent Supreme Court precedent—particularly TransUnion and Spokeo—emphasizing that for standing to exist for an alleged intangible harm, there must be “a close relationship to harms traditionally recognized as providing a basis for a lawsuit in American courts.” Popa v. Microsoft Corp., No. 24-14, 2025 at *11 (9th Cir. Aug. 26, 2025); TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016):

“Popa identifies no embarrassing, invasive, or otherwise private information collected by [the software]. Indeed, the monitoring of Popa’s interactions with the PSP website seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales.” Popa v. Microsoft Corp., at *16.

This analogy to benign, in-person observation in physical retail settings overcame the plaintiff’s efforts to cast the automated collection of web interaction data as “highly offensive” or even historically actionable. The court also rejected any notion that statutory violations alone sufficed to meet Article III’s demands for “injury in fact.”

The Litigation Surge over Web Analytics

Recent years have seen an unprecedented increase in digital privacy class actions, with plaintiffs targeting commonplace website tracking tools under state wiretapping statutes. Since 2022, more than 2,700 such cases have been filed, 87% in California alone, with thousands of businesses named as defendants. ¹ Driven largely by statutory damages incentives and legal theories claiming the “interception” of web activity, these complaints threatened to reshape online business practices nationwide. In recent years dozens of U.S. district courts granted motions to dismiss wiretap lawsuits over alleged misuse of website analytics technology, finding plaintiffs do not suffer an injury in fact solely because their innocuous browsing activity is tracked. ² The tide of costly,  privacy strike suits continues to surge increasingly resembling historic securities class action litigation which ultimately resulted in federal legislative reform in the Privacy and Securities Litigation Reform Act. ³ Dismissals, while meaningful, do not prevent future filings or protect businesses from the significant burdens of defense including discovery, class certification and the asymmetric burdens of the litigation. Legislatures have begun to heed the call to act including procedural mechanisms to make more express legislative intent and limitations on private rights of action, discourage boilerplate complaints, and otherwise ensure that the private plaintiffs’ bar does not lead the way in interpreting criminal laws merely because there is an associated civil right of action.

SB 690 and Harmonization with the California Consumer Privacy Act (CCPA)

Parallel to recent judicial decisions, even California has been among those states seeking to rein in senseless privacy class actions. California’s SB 690⁴, for instance, would amend the California Invasion of Privacy Act (CIPA) to expressly exempt CCPA-compliant, commercially necessary data collection—such as analytics and basic tracking—from CIPA’s private right of action and severe statutory penalties ($5,000 per violation or even criminal liability ). The effect would be to restrict enforcement to the Attorney General and the California Privacy Protection Agency, discouraging opportunistic class actions while reinforcing robust consumer protections under the CCPA. This amendment is aimed at clearly distinguishing legitimate, permission-based analytics from surreptitious or fraudulent interception of communications.

Broader Implications

The Ninth Circuit’s decision is a victory for enterprises that, until recently, faced the practical impossibility of defending thousands of speculative claims nationwide. By insisting on a close historical analogue of recognized harm, federal courts are signaling that private rights of action can only be pursued with plausible allegations—tying asserted statutory violations to real-world harms, not subjective offense or novel statutory theory. Importantly, the ruling suggests that dismissals should be with prejudice, especially for claims relying on identical fact patterns previously adjudicated as non-injurious.

Conclusion

Popa v. Microsoft exemplifies the growing convergence between judicial skepticism of “no-injury” privacy litigation and legislative intent to normalize responsible analytics under well-defined consumer protection statutes. As both federal courts and lawmakers clarify the outer boundaries of digital privacy enforcement, enterprises can hope for a more predictable regulatory landscape. Popa’s holding sharply underscores an accelerating judicial and policy trend even in courts sought after as favorable fora by plaintiffs: subjective and speculative claims of harm, tangible or otherwise, in many circuits will be insufficient to survive standing challenges.  This is especially true where federal courts remain vigilant in their duty when evaluating whether the alleged harms bear a close relationship to harms traditionally recognized as providing a basis for a lawsuit in American courts. Without such a showing, courts following TransUnion will dismiss these cases.  Popa is further significant in that it also suggests the importance of dismissal with prejudice.  Should judges merely dismiss the claims, permit jurisdictional discovery, or allow other means for the cases to remain in court, such a situation will exacerbate the massive drains these types of cases present for many enterprises. Should that happen, calls for further legislative action to curtail privacy strike suits can be expected.

Notes:

1. Digital Wiretapping Litigation Map.
2. Emerging Defenses For Website Tracking Class Actions.
3. https://perma.cc/6EQL-P2HJ (“ More than twenty years ago, Congress recognized and addressed many of these problems in the context of securities class actions by enacting the Private Securities Litigation Reform Act. Intervention by Congress in other substantive areas is now urgently needed to ensure that class actions fulfill their intended purposes rather than serving as vehicles for unjustified and abusive lawsuits.”); https://perma.cc/NEN9-4V2G (“Securities litigation reforms would help drive out meritless cases from the courts that often produce no tangible benefit for the class members. Congress addressed many of these issues in the past with the Private Securities Litigation Reform Act (PSLRA) to ensure the proper functioning of the class action device. Similar reforms are needed in other substantive areas to prevent class actions from being exploited for purposes other than justice.”).
4. https://perma.cc/47K7-KJMQ.